Study: Most Company Networks Vulnerable to Cybercriminals

Positive Technologies has issued a new research report analyzing results of the company’s penetration testing projects carried out in the second half of 2020 and first half of 2021. In 93% of cases, an external attacker can breach an organization’s network perimeter and gain access to local network resources, and it takes an average of two days to penetrate a company’s internal network. In 100% of companies analyzed, an insider can gain full control over the infrastructure.

The study was conducted among financial organizations (29%), fuel and energy organizations (18%), government (16%), industrial (16%), IT companies (13%), and other sectors.

“In 20% of our pen-testing projects, clients asked us to check what unacceptable events might be feasible as a result of a cyberattack,” said Ekaterina Kilyusheva, Head of Research and Analytics at Positive Technologies. “These organizations identified an average of six unacceptable events each, and our pen-testers set out to trigger those. According to our customers, events related to the disruption of technological processes and the provision of services, as well as the theft of funds and important information pose the greatest danger. In total, Positive Technologies pen testers confirmed the feasibility of 71% of these unacceptable events. Our researchers also found that a criminal would need no more than a month to conduct an attack which would lead to the triggering of an unacceptable event. And attacks on some systems can be developed in a matter of days.”

An attacker’s path from external networks to target systems begins with breaching the network perimeter. According to the research, it takes an average of two days to penetrate a company’s internal network. Credential compromise is the main way criminals can penetrate a corporate network (71% of companies), primarily because of simple passwords used, including for accounts used for system administration. An attacker who has the credentials with domain administrator privileges can obtain many other credentials for lateral movement across the corporate network and access to key computers and servers.

According to the study, most organizations have no segmentation of the network by business processes, and this allows attackers to develop several attack vectors simultaneously, and trigger several of a company’s unacceptable events.

The scope of the study included 45 projects for which clients consented to use of results and publication of depersonalized data. The projects were carried out in the second half of 2020 and the first half of 2021.

Channel Impact^®
In bolstering the IT security of clients, partners are urged to begin with an evaluation of the main points of risk, and then determine the proper combination of protection measures, which might include separation of business processes, configuration of security control, enhanced monitoring, and lengthening of the attack chain.